GitHub delays version updates so malware gets caught first

<p>An automated update tool watches a package registry, catches a new release the moment it publishes, and opens a pull request for your team. That is the job it was built to do. In September 2025, that speed cut the wrong way. An attacker phished one npm maintainer&#8217;s credentials and shipped poisoned versions of chalk, debug, and about a dozen other packages. …